SCS-C02 Threat Detection and Incident Response Practice Test 11 — 15 Questions

Question 1

A company uses Amazon RDS for MySQL with automated backups enabled. The security team suspects that a database administrator (DBA) with full RDS access has exfiltrated data by creating a snapshot of the database and sharing it with an external AWS account. The team wants to detect such exfiltration in the future. Which step should the team take to detect and alert on snapshot sharing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Amazon EventBridge rule that triggers on the `ModifyDBSnapshotAttribute` API call and sends an alert via Amazon SNS.. The `ModifyDBSnapshotAttribute` API call is the specific action used to share an RDS snapshot with an external AWS account. By creating an Amazon EventBridge rule that triggers on this API call, the team can immediately send an alert via Amazon SNS, enabling real-time detection and response to unauthorized snapshot sharing. This approach is automated, event-driven, and directly targets the exfiltration vector.

Answer

Use AWS Config to detect changes to RDS snapshot attributes.

Answer

Enable Amazon GuardDuty with RDS Protection.

Answer

Enable AWS CloudTrail and review logs manually.

Question 2

A company uses a hybrid architecture with on-premises servers and AWS. The company uses AWS Site-to-Site VPN to connect to a VPC. The security team suspects that a VPN tunnel has been compromised and an attacker is intercepting traffic. The team needs to verify the integrity of the VPN connection. What is the MOST effective way to detect if traffic is being intercepted?

Accepted Answer

Monitor Amazon CloudWatch metrics for the VPN tunnel, such as tunnel state and data throughput.. Monitoring Amazon CloudWatch metrics for the VPN tunnel, specifically the 'TunnelState' metric, directly indicates whether the tunnel is up or down. A compromised tunnel that is intercepting traffic would likely cause the tunnel to flap or drop unexpectedly, which CloudWatch can alert on. Additionally, abnormal data throughput patterns (e.g., sudden spikes or drops) can signal interception or rerouting of traffic, making this the most effective way to detect integrity issues without relying on traffic content.

Answer

Use AWS Config to check VPN configuration compliance.

Answer

Use a third-party network monitoring tool to perform deep packet inspection.

Answer

Enable VPC Flow Logs and analyze traffic patterns for unusual destinations.

Question 3

A company runs a web application on an Auto Scaling group of EC2 instances behind an Application Load Balancer. The application stores user session data in an ElastiCache Redis cluster. The security team receives an alert from GuardDuty that one of the EC2 instances is communicating with a known command-and-control (C2) IP address. The instance ID is i-0a1b2c3d4e5f. The security engineer needs to contain the threat immediately while preserving the instance for forensic analysis. Which course of action should the security engineer take?

Accepted Answer

Apply a new security group that denies all inbound and outbound traffic to the instance.. Applying a new security group that denies all inbound and outbound traffic immediately stops the C2 communication at the network layer without destroying the instance. This preserves the instance for forensic analysis (e.g., memory dump, disk imaging) while containing the threat. The security group acts as a virtual firewall, and changing it is a non-destructive, reversible action that can be applied directly to the instance even if it is part of an Auto Scaling group.

Answer

Remove the security group from the Auto Scaling group to isolate the instance.

Answer

Terminate the EC2 instance immediately to stop the communication.

Answer

Create an AMI of the instance for forensic analysis and then terminate the instance.

Question 4

A security engineer is investigating a potential data exfiltration incident where an EC2 instance is sending large volumes of data to an unknown IP address. Which AWS service should the engineer use to capture and analyze the network traffic for evidence?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring is the correct choice because it allows you to capture and inspect network traffic from an EC2 instance by mirroring the traffic to a monitoring appliance or a security tool. This enables deep packet inspection to analyze the contents of the data being sent to the unknown IP address, providing evidence for data exfiltration. Unlike other services, Traffic Mirroring operates at the network level, copying all packets (including payloads) without affecting the source instance.

Answer

AWS WAF

Answer

AWS Shield

Answer

Amazon Inspector

Question 5

A company uses AWS Organizations with multiple accounts. The security team wants to detect and automatically respond to suspicious API calls across all accounts. Which solution is the MOST efficient and scalable?

Accepted Answer

Enable AWS CloudTrail organization trail and use Amazon EventBridge to invoke automated responses. Enabling an AWS CloudTrail organization trail centrally logs all API calls from every account in the AWS Organization into a single Amazon S3 bucket and CloudWatch Logs log group. Amazon EventBridge can then be used to create event rules that match specific suspicious API calls (e.g., IAM DeleteRolePolicy) and automatically invoke target actions like AWS Lambda functions or AWS Systems Manager Automation, providing a scalable, centralized, and efficient detection and response mechanism without per-account management overhead.

Answer

Use AWS Config rules to detect API calls and trigger Lambda functions

Answer

Deploy Amazon GuardDuty and use its automated response feature

Answer

Create a CloudTrail trail in each account and aggregate logs via cross-account S3 bucket

Question 6

During an incident investigation, a security analyst finds that an IAM user 'JohnDoe' has been using an access key that was last rotated over 2 years ago. The analyst needs to determine if this key has been compromised. Which approach provides the MOST definitive evidence?

Accepted Answer

Use AWS CloudTrail LookupEvents to find API calls made by the key, focusing on unusual IP addresses or times. AWS CloudTrail LookupEvents allows you to filter API calls by user identity (such as the access key ID) and examine attributes like source IP address, user agent, and timestamp. Unusual IP addresses or times of day are strong indicators of compromise, as they suggest the key is being used from locations or at hours inconsistent with the legitimate user's behavior. This provides the most definitive evidence because it directly correlates the key's usage with anomalous patterns, rather than relying on indirect indicators like data downloads or permission changes.

Answer

Check the S3 access logs to see if the key was used to download sensitive data

Answer

Review the IAM password policy to see if the key was created before the current policy

Answer

Use AWS Config to see if the key's permissions have changed

Question 7

A security engineer is configuring Amazon GuardDuty in a multi-account environment using AWS Organizations. What is the MOST efficient way to enable GuardDuty for all accounts?

Accepted Answer

Enable GuardDuty in the management account and designate a delegated administrator to manage GuardDuty. AWS Organizations allows you to enable GuardDuty at the management account level and then designate a delegated administrator to manage GuardDuty across all member accounts. This approach is the most efficient as it eliminates the need for per-account manual or scripted enablement, leveraging the Organizations API to automatically enroll all existing and future accounts.

Answer

Create a Lambda function that uses AWS Organizations API to enable GuardDuty in each account

Answer

Use AWS Service Catalog to provision GuardDuty across accounts

Answer

Manually enable GuardDuty in each member account

Question 8

A company has a security requirement to capture all DNS queries made by EC2 instances for threat analysis. Which AWS service can provide this capability with minimal configuration?

Accepted Answer

Amazon Route 53 Resolver DNS Firewall. Amazon Route 53 Resolver DNS Firewall can capture and log all DNS queries made by EC2 instances by enabling DNS query logging to Amazon S3 or CloudWatch Logs. This requires minimal configuration because it integrates directly with the VPC's DNS resolver, automatically capturing outbound DNS traffic without needing agents or changes to instance configurations.

Answer

VPC Flow Logs

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 9

A security analyst notices an IAM role 'AdminRole' is being assumed from an IP address outside the company's allowed network. The analyst wants to receive real-time alerts when this role is assumed from unauthorized locations. Which combination of services should be used?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Events, and Amazon SNS. AWS CloudTrail logs IAM role assumption events (sts:AssumeRole) as CloudTrail events, which can be sent to Amazon CloudWatch Events (now Amazon EventBridge) as a real-time event stream. CloudWatch Events rules can then match specific patterns (e.g., source IP outside allowed ranges) and trigger an Amazon SNS notification to alert the security analyst immediately. This combination provides the real-time alerting required without additional polling or storage.

Answer

AWS CloudTrail, Amazon S3, and Amazon Athena

Answer

AWS Config, Amazon SNS, and AWS Lambda

Answer

Amazon GuardDuty and AWS Lambda

Question 10

A company wants to automatically isolate an EC2 instance that is suspected to be compromised. What is the MOST effective AWS-native approach?

Accepted Answer

Use Amazon GuardDuty to detect the compromise and automatically modify the instance's security group to deny all traffic. Amazon GuardDuty can detect suspicious activity on an EC2 instance (e.g., cryptocurrency mining, unusual outbound traffic) and, when integrated with Amazon EventBridge and AWS Lambda, automatically modify the instance's security group to deny all traffic. This approach isolates the instance without terminating it, preserving forensic evidence and allowing further investigation. It is the most effective AWS-native approach because it combines threat detection with automated, least-privilege response actions.

Answer

Terminate the instance immediately

Answer

Use AWS Config to change the instance's IAM role

Answer

Use AWS Systems Manager to run a script that stops the instance

Question 11

A security team needs to analyze historical CloudTrail logs across multiple AWS accounts to detect patterns of suspicious activity. Which solution provides the MOST cost-effective and scalable analysis?

Accepted Answer

Aggregate logs into a central S3 bucket and query with Amazon Athena. Aggregating CloudTrail logs into a central S3 bucket and querying with Amazon Athena is the most cost-effective and scalable solution because Athena uses a serverless, pay-per-query model with no infrastructure to manage, and it can directly analyze large volumes of structured log data stored in S3 using standard SQL. This approach avoids the cost of provisioning and maintaining dedicated clusters (as with Redshift or Elasticsearch) and avoids the per-GB ingestion and storage fees of CloudWatch Logs Insights, making it ideal for historical analysis across multiple accounts.

Answer

Stream logs to Amazon Elasticsearch Service and use Kibana

Answer

Load logs into Amazon Redshift for analysis

Answer

Use Amazon CloudWatch Logs Insights across all accounts

Question 12

A company has a requirement to detect and respond to threats in near real-time by analyzing VPC Flow Logs. The logs are generated in a VPC and sent to CloudWatch Logs. What is the MOST efficient way to analyze these logs for suspicious patterns and trigger automated responses?

Accepted Answer

Use Amazon Kinesis Data Analytics for real-time analysis and AWS Lambda for automated response. Amazon Kinesis Data Analytics can process streaming VPC Flow Logs from CloudWatch Logs in near real-time using SQL or Apache Flink, enabling immediate detection of suspicious patterns. AWS Lambda can then be triggered to automate incident response actions, such as updating security groups or isolating instances, making this the most efficient solution for near real-time threat detection and response.

Answer

Stream logs to Amazon Elasticsearch Service and use Kibana alerts

Answer

Use S3 event notifications to trigger Lambda functions on new log files

Answer

Export logs to S3 and use Amazon Athena queries with scheduled rules

Question 13

Which TWO actions are best practices for securing an AWS account's root user? (Choose 2.)

Accepted Answer

Use a strong password and store it securely. Option B is correct because the root user has unrestricted access to all AWS resources and billing, so it must be protected with a strong, complex password stored in a secure location such as a password manager or secrets vault. Option C is correct because enabling MFA on the root user adds a critical second authentication factor, ensuring that a compromised password alone cannot grant full account control. Options A, D, and E are not best practices: sharing the root password violates least privilege and accountability, using root for daily administrative tasks should be avoided in favor of IAM users or roles, and creating root access keys is discouraged because long-lived root credentials cannot be scoped down and pose a severe security risk.

Answer

Share the root user password with the team for emergency access

Answer

Use the root user for daily administrative tasks

Answer

Create access keys for the root user for programmatic access

Question 14

Which THREE AWS services can be used to detect potentially compromised EC2 instances? (Choose 3.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs (B) capture IP traffic metadata for ENIs, so you can analyze accepted/rejected flows for signs of compromise such as beaconing to known-bad IPs or unusual outbound traffic. Amazon GuardDuty (D) is a managed threat-detection service that continuously analyzes VPC Flow Logs, CloudTrail events, and DNS logs to identify compromised instances via findings like cryptocurrency mining or communication with malicious hosts. Amazon Inspector (E) scans EC2 instances for software vulnerabilities and unintended network exposure, which helps detect an instance that could be or has been compromised through an exploitable weakness. AWS WAF (A) is a Layer 7 web application firewall that filters HTTP(S) requests to CloudFront, ALB, or API Gateway, not an EC2 compromise-detection service. AWS Shield (C) provides DDoS protection at the network/transport layer and does not detect compromised EC2 instances.

Answer

AWS WAF

Answer

AWS Shield

Question 15

Which TWO steps should a security engineer take when responding to a confirmed security incident involving a compromised EC2 instance? (Choose 2.)

Accepted Answer

Isolate the instance by changing its security group to deny all traffic. Option C is correct because isolating the compromised EC2 instance by replacing its security group with one that denies all inbound and outbound traffic is the standard containment step that stops lateral movement and command-and-control communication while preserving the instance's volatile state for investigation. Option D is correct because taking EBS snapshots of the instance's volumes captures a point-in-time, read-only copy of the disk that can be mounted on a separate forensic workstation for evidence preservation and analysis without altering the original data. Option A is not appropriate as a first response because reimaging destroys volatile evidence and should only occur after containment and forensic capture are complete. Option B is wrong because deleting CloudTrail logs is log tampering that destroys the audit trail needed for the investigation. Option E is wrong because terminating the instance shuts it down and can destroy volatile memory and instance-store data before evidence is collected.

Answer

Reimage the instance from a clean AMI immediately

Answer

Delete all CloudTrail logs related to the instance

Answer

Immediately terminate the instance to stop the attack